CVE-2014-1948: Medium severity Openstack Image Registry And Delivery Service \(glance\) vulnerability
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/glanceto a version that resolves this vulnerability.Fixed in 11.0.0a0
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1948?
CVE-2014-1948 is classified as a medium severity vulnerability that exposes sensitive information due to improper logging.
Which versions of OpenStack are affected by CVE-2014-1948?
CVE-2014-1948 affects OpenStack Image Registry and Delivery Service (Glance) versions 2013.2 through 2013.2.1 and Icehouse before icehouse-2.
How do I fix CVE-2014-1948?
To mitigate CVE-2014-1948, upgrade to Glance version 11.0.0a0 or later.
What type of information is exposed by CVE-2014-1948?
CVE-2014-1948 allows local users to access the Swift store backend password through logging.
Can local users exploit CVE-2014-1948?
Yes, local users can exploit CVE-2014-1948 to obtain sensitive information from logs if they have access to the affected system.